News & Sicurezza

PoC Exploit Released for Grandstream GXP1600 VoIP Phones RCE Vulnerability Grandstream GXP1600 VoIP Phones RCE Vulnerability A critical zero-day vulnerability, tracked as CVE-2026-2329, is affecting Grandstream’s GXP1600 series VoIP desk phones. The issue is an unauthenticat ... Read more Published Date: Feb 23, 2026 (1 day, 15 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-2329

jsPDF Vulnerability Exposes Millions of Developers to Object Injection Attacks jsPDF Vulnerability Injection Attacks A newly disclosed security flaw in the popular jsPDF library has exposed millions of web developers to PDF Object Injection attacks, allowing remote attackers to ... Read more Published Date: Feb 23, 2026 (1 day, 15 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-25755

HPE Telco Service Activator Vulnerability Let Attackers Bypass Access Restrictions HPE Telco Service Activator Vulnerability Security Bulletin released on February 19, 2026, addresses a remote flaw in HPE Telco Service Activator that could let attackers bypass access restrictions. ... Read more Published Date: Feb 23, 2026 (1 day, 13 hours ago) Vulnerabilities has been mentioned in this article. CVE-2025-12543

VS meldt actief misbruik van XSS-lek in Roundcube Webmail Aanvallers maken actief misbruik van een cross-site scripting (XSS) kwetsbaarheid in Roundcube Webmail, zo laat het Amerikaanse cyberagentschap CISA weten. Eind vorig jaar verschenen er beveiligingsup ... Read more Published Date: Feb 23, 2026 (1 day, 14 hours ago) Vulnerabilities has been mentioned in this article. CVE-2025-68461

Hackers Use Excel Exploit to Hide XWorm 7.2 in JPEG Files, Hijack PCs If a strange email about a “payment detail request” or “signed bank document” lands in your inbox, your best bet is to delete it immediately. A fresh investigation by Fortinet’s FortiGuard Labs warns ... Read more Published Date: Feb 23, 2026 (1 day, 14 hours ago) Vulnerabilities has been mentioned in this article. CVE-2018-0802

CISA Warns of Multiple Roundcube Vulnerabilities Exploited in Attacks CISA has officially updated its Known Exploited Vulnerabilities (KEV) Catalog to include new security flaws affecting a popular webmail platform. On February 20, 2026, the agency added two critical vu ... Read more Published Date: Feb 23, 2026 (1 day, 12 hours ago) Vulnerabilities has been mentioned in this article. CVE-2025-68461 CVE-2025-49113

CVE ID : CVE-2025-59873 Published : Feb. 23, 2026, 11:16 a.m. | 7 hours, 49 minutes ago Description : An information exposure vulnerability exists in Vulnerability in HCL Software ZIE for Web. The application transmits sensitive session tokens and authentication identifiers within the URL query parameters . An attacker who gains access to any network log or operates a site linked from the application can hijack user sessions This issue affects ZIE for Web: v16. Severity: 5.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-2985 Published : Feb. 23, 2026, 11:16 a.m. | 7 hours, 49 minutes ago Description : A security flaw has been discovered in Tiandy Video Surveillance System 视频监控平台 7.17.0. This impacts the function downloadImage of the file /com/tiandy/easy7/core/bo/CLSBODownLoad.java. Performing a manipulation of the argument urlPath results in server-side request forgery. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2025-40986 Published : Feb. 23, 2026, 11:16 a.m. | 7 hours, 49 minutes ago Description : Reflected Cross-Site Scripting (XSS) vulnerability in PideTuCita. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending him/her a malicious URL using the endpoint 'cookies/indes.php/'. This vulnerability can be exploited to steal confidential user data, such as session cookies or to perform actions on behalf of the user. Severity: 5.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2025-40701 Published : Feb. 23, 2026, 11:16 a.m. | 7 hours, 49 minutes ago Description : Reflected Cross-Site Scripting vulnerability in SOTESHOP, version 8.3.4. THis vulnerability allows an attacker execute JavaScript code in the victim's browser when a malicious URL with the 'id' parameter in '/adsTracker/checkAds' is sent to the victim. The vulnerability can be exploited to steal sensitive user information such as session cookies, or to perform actions on their behalf. Severity: 5.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

A vulnerability was determined in SourceCodester Student Result Management System 1.0. The impacted element is an unknown function of the file /admin/core/import_users.php of the component Bulk Import. This manipulation of the argument File causes improper access controls. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

CVE ID : CVE-2026-2983 Published : Feb. 23, 2026, 10:16 a.m. | 8 hours, 48 minutes ago Description : A vulnerability was determined in SourceCodester Student Result Management System 1.0. The impacted element is an unknown function of the file /admin/core/import_users.php of the component Bulk Import. This manipulation of the argument File causes improper access controls. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...